How to Remove "Malware Protection" (Uninstall Guide)

Malware Protection is a rogue anti-virus application that runs a fake system scan and then concludes that your computer has a malware infection or serious security/privacy issues. To fix the malware infection you must pay a fee, about $50. The rogue program copies user interface elements from real programs and it looks like a legitimate application. Plenty of people shell out $50 to register this fraud and that's a big problem because if you're transacting with these guys online you're offering them your credit card details. Cyber criminals can later user that information to their benefit. You should protect yourself with common sense and legitimate anti-virus software because such fake anti-virus applications as Malware Protection now represent about 20% of all malware in circulation. If you made a mistake and purchased it, please contact your credit card company and dispute the charges. And if you still have this fake AV on your computer, please follow the removal instructions below to remove Malware Protection and related malware for free.



Malware Protection 2011 is a re-branded version of Spyware Protection scareware. I'm pretty sure we'll see a whole new set of rogue applications like these two in the next few weeks. In a common scenario, Malware Protection is promoted via infected websites that redirect users to fake virus scanners claiming to sell antivirus software. Well, it's basically a pop-up message, alerting you that your computer is infected with viruses, Trojans or even spyware. Once installed, Malware Protection will pretend to scan your computer malicious software, virus and other security problems. As you can imagine, it will state that your computer is infected. It will block other programs on your computer and will close web browser if you try to download anti-malware or anti-virus software.





It claims that your web browser or any other problem really, was infected by some form of malware that may send your sensitive information to a remove computer or make your computer unusable, e.g., W32/Blaster.Worm.

iexplore.exe can not start
File iexplore.exe is infected by W32/Blaster.worm
Please activate Malware Protection to protect your computer.

This scam has been around for some time now, nothing new. After the fake scan, Malware Protection takes you to a web page where you can purchase it.

The good news is that Malware Protection "designed to protect" can be removed from your computer rather easily. You can reboot your computer in safe mode with networking and download anti-malware tool or you can delete Malware Protection files manually.

SL55J-T54YHJ61-YHG88 you can also use this code (and any email) to register the rogue program. This will stop the annoying security alerts. And the rogue program won't blog security related websites anymore. Then download recommended anti-malware software (Spyware Doctor) and run a full system scan to remove the rogue virus from your computer. If you have any further questions, please leave a comment. Good luck and be safe online!

---

Manual Malware Protection removal instructions:

1. Right click on the "Malware Protection" icon, click Properties in the drop-down menu, then click the Shortcut tab.

The location of the malware is in the Target box.

NOTE: by default, Application Data folder is hidden. Malware files are hidden as well. To see hidden files and folders, please read Show Hidden Files and Folders in Windows.

Under the Hidden files and folders section, click Show hidden files and folders, and remove the checkmark from the checkbox labeled:

- Hide extensions for known file types
- Hide protected operating system files

Click OK to save the changes. Now you will be able to see all files and folders in the Application Data/Program Data directory.

3. Rename malicious process.

File location, Windows XP:
C:\Documents and Settings\All Users\Application Data\defender.exe

File location, Windows Vista/7:
C:\ProgramData\defender.exe

Rename defender.exe to virus.exe or whatever you like.


4. Restart your computer. The malware should be inactive after the restart.

5. Open Internet Explorer and download TDSSKiller. This malware usually (but not always) comes bundled with TDSS rootkit. Removing this rootkit from your computer is very important (if exists). Run TDSSKiller and remove the rootkit.



6. And finally, download recommended anti-malware software (Spyware Doctor) and run a full system scan to remove the rogue virus from your computer.

---

Malware Protection removal instructions in Safe Mode with Networking:

1. Please reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key.

Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm


NOTE: Login as the same user you were previously logged in with in the normal Windows mode.

2. Open Internet Explorer and download TDSSKiller. Run the utility.

3. Then download recommended anti-malware software (Spyware Doctor) and run a full system scan to remove the rogue virus from your computer.

---

Malware Protection associated files and registry values:

Files:

• C:\Documents and Settings\[UserName]\Application Data\defender.exe

Registry values:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Malware Protection"

Share this information with other people: